Vulnerabilities > Open EMR > Openemr > 5.0.2.1

DATE CVE VULNERABILITY TITLE RISK
2021-02-15 CVE-2020-29142 SQL Injection vulnerability in Open-Emr Openemr
A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when restrict_user_facility=on is in global settings.
network
low complexity
open-emr CWE-89
6.5
6.5
2021-02-07 CVE-2020-36243 OS Command Injection vulnerability in Open-Emr Openemr 5.0.2.1
The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php.
network
low complexity
open-emr CWE-78
critical
 9.0
9.0